release.yml

name: Release provider binary

on:
  push:
    tags:
      - "v*"
  release:
    types:
      - published
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing release tag to publish assets to"
        required: true

permissions:
  contents: write

jobs:
  release:
    name: ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: macos-latest
            target: aarch64-apple-darwin
    env:
      BINARY: py-harness
      GH_TOKEN: ${{ github.token }}
      RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag || github.ref_name }}
      TARGET: ${{ matrix.target }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Ensure release tag
        if: github.event_name == 'workflow_dispatch'
        shell: bash
        run: |
          set -euo pipefail
          case "$RELEASE_TAG" in
            v*) ;;
            *) echo "release tag must start with v: $RELEASE_TAG" >&2; exit 2 ;;
          esac
          git fetch --tags --force
          if ! git rev-parse -q --verify "refs/tags/${RELEASE_TAG}" >/dev/null; then
            git tag "$RELEASE_TAG" "$GITHUB_SHA"
            git push origin "refs/tags/${RELEASE_TAG}"
          fi

      - name: Install uv
        uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Build wheel
        run: |
          uv sync --group test --locked
          uv build

      - name: Package provider binary
        shell: bash
        run: |
          set -euo pipefail
          rm -rf build dist package py_harness_entry.py
          cat > py_harness_entry.py <<'PY'
          from python_lang_project_harness import run_cli_from_env

          raise SystemExit(run_cli_from_env())
          PY
          uv run --with 'pyinstaller>=6,<7' python -m PyInstaller \
            --clean \
            --name "$BINARY" \
            --paths src \
            --collect-submodules python_lang_parser \
            --collect-submodules python_lang_project_harness \
            py_harness_entry.py
          mkdir -p package
          cp -R "dist/${BINARY}/." package/
          chmod +x "package/${BINARY}"
          "package/${BINARY}" --help >/dev/null
          file "package/${BINARY}"
          case "$TARGET" in
            x86_64-unknown-linux-gnu)
              file "package/${BINARY}" | grep -Eq 'ELF.*x86-64|ELF.*x86_64'
              ;;
            aarch64-apple-darwin)
              file "package/${BINARY}" | grep -Eq 'Mach-O.*arm64|Mach-O.*aarch64'
              ;;
          esac
          mkdir -p perf-fixture/src/pkg
          cat > perf-fixture/src/pkg/service.py <<'PY'
          def fetch():
              return 1


          def build():
              return 2
          PY
          python - "$PWD/package/${BINARY}" <<'PY'
          import json
          import pathlib
          import statistics
          import subprocess
          import sys
          import time

          binary = pathlib.Path(sys.argv[1])
          command = [
              str(binary),
              "search",
              "owner",
              "src/pkg/service.py",
              "items",
              "--query",
              "fetch|build",
              "--workspace",
              "perf-fixture",
              "--json",
          ]
          subprocess.run(command, check=True, stdout=subprocess.DEVNULL)
          samples = []
          for _ in range(6):
              started_at = time.perf_counter()
              output = subprocess.run(
                  command,
                  check=True,
                  stdout=subprocess.PIPE,
                  text=True,
              )
              elapsed_ms = (time.perf_counter() - started_at) * 1000
              packet = json.loads(output.stdout)
              assert packet["runtimeCost"]["reason"] == "owner-items-exact-owner-prefilter"
              samples.append(elapsed_ms)
          median_ms = statistics.median(samples)
          max_ms = max(samples)
          print(
              "owner-items-perf",
              "samples_ms=" + ",".join(f"{sample:.1f}" for sample in samples),
              f"median_ms={median_ms:.1f}",
              f"max_ms={max_ms:.1f}",
          )
          if median_ms >= 500 or max_ms >= 750:
              raise SystemExit(
                  f"owner-items binary warm path exceeded gate: median={median_ms:.1f}ms max={max_ms:.1f}ms"
              )
          PY
          asset="${BINARY}-${TARGET}.tar.gz"
          tar -czf "$asset" -C package .
          python - "$asset" <<'PY'
          import hashlib
          import pathlib
          import sys

          asset = pathlib.Path(sys.argv[1])
          digest = hashlib.sha256(asset.read_bytes()).hexdigest()
          pathlib.Path(f"{asset}.sha256").write_text(f"{digest}  {asset.name}\n")
          PY

      - name: Publish release assets
        shell: bash
        run: |
          set -euo pipefail
          gh release view "$RELEASE_TAG" >/dev/null 2>&1 \
            || gh release create "$RELEASE_TAG" --verify-tag --title "$RELEASE_TAG" --notes "Provider binary release $RELEASE_TAG" \
            || gh release view "$RELEASE_TAG" >/dev/null
          gh release upload "$RELEASE_TAG" "${BINARY}-${TARGET}.tar.gz" "${BINARY}-${TARGET}.tar.gz.sha256" --clobber